elanous 0.2.15 → 0.2.17

package/src/self-dev/ask-launch-flow.ts

@@ -11,6 +11,7 @@
 // ⛔ 종료(`process.exit`)는 여기가 «안» 한다 — 호출자가 자기 표면에 맞게 끝낸다.
 //   그래서 결과를 «세 값»으로 낸다: 발사 / 저작 전 중단 / 전제 검사 중단.
 import { linesOutsideFencedCode } from '../self-implement/goal-author.js';
+import { recordAuthoredGoal } from './authored-goal-trace.js';
 import { retiredEntranceNotice, type EntranceDeclaration } from './entrance-registry.js';
 import {
   classifyConcurrentAuthoring,
@@ -34,6 +35,8 @@ import { dirname, isAbsolute as isAbsolutePath, relative as relativePath, resolv
 import {
   applyClarificationReply,
   planClarificationIntake,
+  selfAnswerGoalDocumentClarifications,
+  type GoalClarificationSelfResolver,
 } from '../self-implement/goal-author-clarification.js';
 import { classifyReauthoredAsk, countMissingAuthoredConstraintMarkers, askGoalTypeDeclaration, declaredGoalType, parseGoalId } from '../self-implement/goal-author.js';
 import { observeFrontNodeEntry } from './graph-front-nodes.js';
@@ -58,7 +61,7 @@ function resolveSelfResolveClarifications(explicit: boolean | undefined): Resolv
 /** 저작기 산출 — `runGoalAuthorCli` 의 반환에서 이 흐름이 «실제로 쓰는» 것만. */
 export interface AskAuthoredGoal {
   readonly path: string;
-  readonly authored?: { readonly document?: string; readonly grounded?: boolean | null } | null;
+  readonly authored?: { readonly document?: string; readonly grounded?: boolean | null; readonly authorRunId?: string } | null;
 }
 
 export type LaunchingTreeProbe =
@@ -142,6 +145,9 @@ export interface AskLaunchFlowDeps {
   /** Optional structured clarification adapter. Omitted callers retain the
    * existing CLI line-input contract exactly. */
   readClarification?(clarification: GoalDocumentClarification): Promise<string>;
+  selfResolveClarification?: GoalClarificationSelfResolver;
+  /** Replaces the goal document after a self-answer; production entrances pass an atomic writer. */
+  writeGoalDocument?(path: string, document: string): void;
   readFile(path: string): string;
   writeFile(path: string, data: string): void;
   cwd(): string;
@@ -158,6 +164,8 @@ export interface AskLaunchFlowDeps {
   /** ⛔ 못 얻으면 `null` — 같은 이유. */
   recentAuthoringSamples(): RecentAuthoringSample[] | null;
   authorGoal(args: readonly string[], options: Record<string, unknown>): Promise<AskAuthoredGoal>;
+  /** AUTHOR-TRACE seam (tests). */
+  recordAuthoredGoal?: typeof recordAuthoredGoal;
   /** Pod launches reserve a host slot before goal authoring begins. */
   beforeAuthoring?(): Promise<void>;
   /** 발사 전 권고용 분해 seam. 생략하면 전용 관측명을 준 기존 분해기를 쓴다. */
@@ -185,6 +193,7 @@ export interface AskLaunchFlowInput {
   readonly askFile?: string;
   /** Optional repository root used only for code grounding during goal authoring. */
   readonly groundingCwd?: string;
+  readonly authorGrade?: import('../self-implement/goal-author.js').GoalAuthorGradeSelection;
   readonly liveRunWindowMinutes: number;
   readonly recentChangeWindowDays: number;
   readonly forceRequested: boolean;
@@ -721,16 +730,27 @@ async function intakeClarifications(
     return effectiveGoalFile;
   }
   if (mode === 'deferred-noninteractive') {
-    // ⛔⭐ 종전엔 「N건 있다」만 말하고 «무엇을 묻는지»도 «어떻게 답하는지»도 안 줬다.
-    //   ⇒ 비대화형 표면(무인 런 · TUI 슬래시)에서 그 물음은 사실상 «사라졌다».
-    //   ⛔ 여기에 새 인터뷰 UI 를 만들지 «않는다» — 답변 창구는 `elanous self clarify answer` 로 «이미» 있다.
-    //     이 자리는 그것을 «가리키기»만 한다(2026-08-11 72차: 오늘만 `F12` 를 여섯 번 셌다).
-    deps.print(`[ask] ⑴b ⚠️ 미답 되묻기 ${pending.length}건 — 저작은 그대로 간다 · 구현 전에 LLM 릴레이가 먼저 답하고, 못 하면 미답으로 진행한다 (사람을 기다리지 않는다)`);
-    for (const item of pending) {
+    // The resolver comes in through deps (I/O seam): production entrances pass the author
+    // self-resolver; a caller that injects none keeps the previous deferred behaviour.
+    if (selfResolveClarifications.value && deps.selfResolveClarification) try {
+      const resolution = await selfAnswerGoalDocumentClarifications(document, {
+        path: 'ask', ask: input.askText, resolver: deps.selfResolveClarification,
+      });
+      if (resolution.newlyAnswered > 0) {
+        (deps.writeGoalDocument ?? deps.writeFile)(effectiveGoalFile, resolution.document);
+        document = resolution.document;
+      }
+    } catch (error) {
+      deps.log('ask-clarify', { goalFile: effectiveGoalFile, reason: 'self-answer-failed', error: error instanceof Error ? error.message : String(error) }, 'warn');
+    }
+    const remaining = planClarificationIntake(document, false).pending;
+    // 미답으로 남은 문항만 기존 답변 창구를 안내한다.
+    deps.print(`[ask] ⑴b ⚠️ 미답 되묻기 ${remaining.length}건 — 저작은 그대로 간다 · 구현 전에 LLM 릴레이가 먼저 답하고, 못 하면 미답으로 진행한다 (사람을 기다리지 않는다)`);
+    for (const item of remaining) {
       deps.print(`[ask]    ❓ [${item.questionId}] ${item.question}`);
       item.options.forEach((option, index) => deps.print(`[ask]       ${index}) ${option.label}`));
     }
-    if (pending.length > 0) {
+    if (remaining.length > 0) {
       const goalArg = deps.relativeToCwd(effectiveGoalFile);
       deps.print(`[ask]    ▶ 답하려면: elanous self clarify answer ${goalArg} <questionId> <옵션번호>   (자유 답은 --other "<문장>")`);
       deps.print(`[ask]    ▶ 답한 뒤 재저작: elanous self author --supersedes ${goalArg}`);
@@ -768,6 +788,7 @@ async function intakeClarifications(
   const reauthored = await deps.authorGoal([], {
     cwd: deps.cwd(),
     ...(input.groundingCwd === undefined ? {} : { groundingCwd: input.groundingCwd }),
+    ...(input.authorGrade === undefined ? {} : { authorGrade: input.authorGrade }),
     fromClarification: `${deps.relativeToCwd(effectiveGoalFile)}#${seedQuestionId}`,
     reauthorFromAnsweredClarification: true,
     selfResolveClarifications: selfResolveClarifications.value,
@@ -850,6 +871,7 @@ export async function runAskLaunchFlow(
     const authored = await deps.authorGoal([input.askText], {
       cwd: deps.cwd(),
       ...(input.groundingCwd === undefined ? {} : { groundingCwd: input.groundingCwd }),
+      ...(input.authorGrade === undefined ? {} : { authorGrade: input.authorGrade }),
       ...(goalType === null ? {} : { goalType }),
       // ⛔ 인라인 ask(`harness say`)는 askFile 이 없다 — 그 칸을 넘기면 저작기가 빈 줄을 쓴다.
       ...(() => {
@@ -861,6 +883,24 @@ export async function runAskLaunchFlow(
       selfResolveClarifications: selfResolveClarifications.value,
     });
     deps.print(`[ask] 저작됨: ${authored.path}`);
+    // AUTHOR-TRACE: the authored goal file can be cleaned up later — keep path ⊕ sha256 ⊕ size in the run ledger and
+    // archive the body, so authoring length is measurable after the fact (GOAL-BENCH · AUTHOR-LITE).
+    const traceIds = {
+      ...(input.runId === undefined ? {} : { runId: input.runId }),
+      ...(authored.authored?.authorRunId === undefined ? {} : { authorRunId: authored.authored.authorRunId }),
+    };
+    if (authored.authored?.document !== undefined && (traceIds.runId !== undefined || traceIds.authorRunId !== undefined)) {
+      try {
+        const trace = (deps.recordAuthoredGoal ?? recordAuthoredGoal)(traceIds, authored.path, authored.authored.document);
+        deps.log('goal-authored-trace', { ...traceIds, ...trace }, 'info');
+      } catch (error) {
+        deps.log('goal-authored-trace-failed', { ...traceIds, error: error instanceof Error ? error.message : String(error) }, 'warn');
+      }
+    } else {
+      deps.log('goal-authored-trace-skipped', {
+        reason: authored.authored?.document === undefined ? 'no-authored-document' : 'no-run-or-author-id', path: authored.path,
+      }, 'warn');
+    }
     const markerCounts = authored.authored?.document === undefined
       ? null
       : countMissingAuthoredConstraintMarkers(input.askText, authored.authored.document);

package/src/self-dev/authored-goal-trace.ts

@@ -0,0 +1,64 @@
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { appendRunLedgerEntry, runLedgerDir } from '../self-implement/run-ledger.js';
+import { debug } from '../debug/log.js';
+
+/** AUTHOR-TRACE: what `harness say`/`ask` authored, kept with the run — the goal file itself may be cleaned up later,
+ *  so the ledger carries path ⊕ sha256 ⊕ size and the body is archived next to the ledger. */
+export interface AuthoredGoalTrace {
+  path: string;
+  sha256: string;
+  chars: number;
+  sections: number;
+  archivedAt: string;
+}
+
+/** `## ` headings outside fenced code (a fence closes only on the same marker, at least as long). */
+function countSections(document: string): number {
+  let fence: { char: string; length: number } | null = null;
+  let count = 0;
+  for (const line of document.split('\n')) {
+    const marker = /^ {0,3}(`{3,}|~{3,})/.exec(line);
+    if (fence) {
+      if (marker && marker[1]![0] === fence.char && marker[1]!.length >= fence.length && line.trim() === marker[1]) fence = null;
+      continue;
+    }
+    if (marker) { fence = { char: marker[1]![0]!, length: marker[1]!.length }; continue; }
+    if (/^ {0,3}##\s/.test(line)) count += 1;
+  }
+  return count;
+}
+
+export function authoredGoalTrace(path: string, document: string, archivedAt: string): AuthoredGoalTrace {
+  return {
+    path,
+    sha256: createHash('sha256').update(document).digest('hex'),
+    chars: [...document].length,
+    sections: countSections(document),
+    archivedAt,
+  };
+}
+
+/** Archive the body, emit one `goal-author`/`goal-authored` observation and — when the run id is already known —
+ *  append a `goal-authored` run-ledger event. At `harness say` authoring time the run id usually does not exist yet;
+ *  the authoring run id (`authorRunId`, joined to the goal by `goal-id-assigned`) keys the record then. */
+export function recordAuthoredGoal(
+  ids: { runId?: string; authorRunId?: string },
+  path: string,
+  document: string,
+  options: { ledgerDir?: string; archiveDir?: string } = {},
+): AuthoredGoalTrace {
+  const key = ids.runId ?? ids.authorRunId;
+  if (!key) throw new Error('recordAuthoredGoal needs a runId or an authorRunId');
+  const ledgerDir = options.ledgerDir ?? runLedgerDir();
+  const archiveDir = options.archiveDir ?? join(dirname(ledgerDir), 'authored-goals');
+  const digest = createHash('sha256').update(document).digest('hex');
+  const archived = join(archiveDir, `${key}-${digest.slice(0, 12)}.md`);
+  if (!existsSync(archiveDir)) mkdirSync(archiveDir, { recursive: true });
+  writeFileSync(archived, document, 'utf8');
+  const trace = authoredGoalTrace(path, document, archived);
+  debug.log('goal-author', 'goal-authored', { ...ids, ...trace });
+  if (ids.runId) appendRunLedgerEntry({ runId: ids.runId, event: 'goal-authored', data: { ...trace, ...(ids.authorRunId ? { authorRunId: ids.authorRunId } : {}) } }, ledgerDir);
+  return trace;
+}

package/src/self-dev/dev-cli.ts

@@ -43,6 +43,7 @@ import { observeDeliverables, type DeliverableObservationResult, type Deliverabl
 import { debug } from '../debug/log.js';
 import { getUserConfig, type UserConfig } from '../user-config.js';
 import { resolveChildLlmPreference, type ChildLlmPreferenceInput, type ResolvedChildLlmPreference } from '../self-implement/child-llm-preference.js';
+import { applyLaunchOverloadFailover, codexProviderNamed } from '../oauth/overload-failover-launch.js';
 import { readCachedGrokQuota } from '../oauth/codex-account-store.js';
 import { queryAbandonedDraftPrs, type AbandonedDraftPr } from '../cli/logs-abandoned-draft-prs.js';
 import { branchLineageSlug } from '../cli/pr-lineage.js';
@@ -1631,6 +1632,18 @@ function resolveChildLlmFromParts(
   return undefined;
 }
 
+/** Pinned `tools.selfImplement.childLlm` naming codex. Fallback-chain codex is not pinned. */
+function childLlmCodexPinned(flagProvider: string | undefined): boolean {
+  if (flagProvider !== undefined) return false;
+  try {
+    const preference = resolveChildLlmPreference(getUserConfig());
+    const provider = preference.chain[0]?.provider;
+    return preference.mode === 'pinned' && preference.source.chain === 'pinned' && codexProviderNamed(provider);
+  } catch {
+    return false;
+  }
+}
+
 export function buildChildLlmSelection(
   opts: Pick<DevCliOpts, 'childLlmProvider' | 'childLlmModel' | 'childLlmEffort'> & {
     /** 발사 인자가 있을 때 관측용 선호를 읽는다. 없으면 getUserConfig. 기존 두 인자 시그니처는 그대로다. */
@@ -1967,7 +1980,12 @@ export function buildDevCliSpec(
   }
 
   if (path === 'self-mission') {
-    const childLlm = buildChildLlmSelection({ ...opts, readPreference: () => getUserConfig() });
+    const builtChild = buildChildLlmSelection({ ...opts, readPreference: () => getUserConfig() });
+    const childLlm = applyLaunchOverloadFailover(builtChild, {
+      provider: opts.childLlmProvider,
+      model: opts.childLlmModel,
+      codexPinned: childLlmCodexPinned(opts.childLlmProvider),
+    });
     // 잔량 조회(약 3초)는 한 발사에 한 번만 — 자식·부모가 같은 값을 쓴다.
     let grokQuotaOnce: ReturnType<typeof readCachedGrokQuota> | undefined;
     const readGrokQuotaOnce = () => (grokQuotaOnce ??= readGrokQuota());

package/src/self-dev/dev-pipeline.ts

@@ -1863,9 +1863,9 @@ async function observeDevTaskDispatch(spec: DevPipelineSpec, plan: ResolvedDevPl
   }
 }
 
-async function inspectReleasePathBeforeMerge(seams: SelfImplementSeams, number: number, cwd: string): Promise<string | undefined> {
+async function inspectReleasePathBeforeMerge(seams: SelfImplementSeams, number: number, cwd: string, base?: string): Promise<string | undefined> {
   if (!seams.readPrFiles) throw new Error('release-path inspection unavailable — automatic merge refused');
-  const files = await seams.readPrFiles({ number, cwd });
+  const files = await seams.readPrFiles({ number, cwd, ...(base ? { base } : {}) });
   if (!Array.isArray(files) || !files.every((path) => typeof path === 'string')) throw new Error('invalid PR file list — automatic merge refused');
   const path = releasePathHold(files);
   if (!path) return undefined;
@@ -2107,10 +2107,11 @@ async function runDevPipelineDispatch(
       ...assembledSeams,
       ...(assembledSeams.mergePr ? { mergePr: async (input) => {
         let path: string | undefined;
-        try { path = await inspectReleasePathBeforeMerge(assembledSeams, input.number, input.cwd); }
+        try { path = await inspectReleasePathBeforeMerge(assembledSeams, input.number, input.cwd, plan.base); }
         catch (error) {
-          debug.log('self-dev.merge', 'release-path-inspection-failed', { number: input.number, error: String(error) });
-          return { merged: false, detail: `automatic merge refused: ${String(error)}` };
+          const rateLimited = error instanceof Error && (error as { rateLimited?: boolean }).rateLimited === true;
+          debug.log('self-dev.merge', 'release-path-inspection-failed', { number: input.number, error: String(error), ...(rateLimited ? { rateLimit: true } : {}) });
+          return { merged: false, detail: rateLimited ? `automatic merge refused: rate-limit: ${String(error)}` : `automatic merge refused: ${String(error)}` };
         }
         if (path) return { merged: false, detail: `OP approval required: ${path}` };
         return assembledSeams.mergePr!(input);

package/src/self-dev/entrance-registry.ts

@@ -1,6 +1,6 @@
 import { findNativeTool, isNativeToolModelExposed } from '../native-tool-catalog.js';
 
-export type EntranceStatus = 'live' | 'retired';
+export type EntranceStatus = 'live' | 'retired' | 'closed';
 
 export type EntranceStampability = 'stampable' | 'structurally-unstampable' | 'unknown';
 
@@ -181,12 +181,14 @@ const ENTRANCE_DECLARATIONS = [
   //       `dev --ask` 와 ***같은*** `runAskLaunchFlow` 를 탄다. 두 문의 차이는 `entrance` 태그뿐이다.
   //     ⇒ 판정값이 `'verified' | 'unknown'` 둘뿐이라 「구조적 부재」를 적을 칸이 없다. `unknown` 으로 둔다.
   //     ⛔ 그러니 이 `unknown` 을 「미완」으로 읽지 마라 — 그 구분은 이 주석이 canonical 이다.
-  { id: 'cli-dev-ask', surface: 'cli', status: 'live', verification: { actualMission: 'verified', legacyParity: 'unknown' } },
+  // OLD-DOOR-CLOSE — a direct `dev --ask` from a terminal or seat session refuses.
+  // Harness-internal calls still pass, marked with the ONEDOOR-1 entrance stamp.
+  { id: 'cli-dev-ask', surface: 'cli', status: 'closed', verification: { actualMission: 'verified', legacyParity: 'unknown' } },
   // `elanous drive` 는 `elanous dev` 의 Commander alias 로 살아 있고, buildDriveAliasDevSpec 이 entrance 를
   // `cli-drive` 로 넘기며 completion 을 `worktree-only` 로 못 박는다. 그래서 별도 무인 권한 축이 아니다.
   { id: 'cli-drive', surface: 'cli', status: 'live' },
-  { id: 'cli-self-implement', surface: 'cli', status: 'live' },
-  { id: 'cli-self-orchestrate', surface: 'cli', status: 'live' },
+  { id: 'cli-self-implement', surface: 'cli', status: 'closed' },
+  { id: 'cli-self-orchestrate', surface: 'cli', status: 'closed' },
   // ⭐ 2026-08-22 · 🅣 — ***사람이 «돌려 보고» 적은 판정***이다(⛔ 도구가 추측한 값이 아니다).
   //   actualMission: 그 입구로 실제 골을 «끝까지» 돌렸다 — 17발 · 자동 병합 5 · 회수 착지 7.
   //     📏 원장 각인이 그것을 말한다: `"entrance":"cli-harness-ask"` (아침엔 0건이었다).
@@ -331,6 +333,7 @@ export function summarizeEntrances(registry: readonly EntranceDeclaration[] = EN
   readonly total: number;
   readonly live: number;
   readonly retired: number;
+  readonly closed: number;
   readonly bySurface: ReadonlyArray<{ surface: EntranceSurface; total: number; retired: number }>;
 } {
   const surfaces = [...new Set(registry.map((e) => e.surface))];
@@ -338,6 +341,7 @@ export function summarizeEntrances(registry: readonly EntranceDeclaration[] = EN
     total: registry.length,
     live: registry.filter((e) => e.status === 'live').length,
     retired: registry.filter((e) => e.status === 'retired').length,
+    closed: registry.filter((e) => e.status === 'closed').length,
     bySurface: surfaces.map((surface) => ({
       surface,
       total: registry.filter((e) => e.surface === surface).length,
@@ -350,12 +354,12 @@ export function summarizeEntrances(registry: readonly EntranceDeclaration[] = EN
 export function renderLaunchEntrances(registry: readonly EntranceDeclaration[] = ENTRANCE_REGISTRY): string {
   const summary = summarizeEntrances(registry);
   const rows = listEntrancesWithModelExposure(registry)
-    .map((e) => `  ${e.status === 'retired' ? '🪦' : '✅'} ${e.surface.padEnd(7)} ${e.id} (${e.stampability}) verification=actualMission:${e.verification.actualMission},legacyParity:${e.verification.legacyParity} imprintEvidence=${e.imprintEvidence} evidenceSource=${e.stampabilityEvidenceSource} evidenceSourceFilePath=${e.evidenceSourceFilePath ?? 'missing'} modelExposed=${e.modelExposed ?? 'missing'}`);
+    .map((e) => `  ${e.status === 'retired' ? '🪦' : e.status === 'closed' ? '닫힘' : '✅'} ${e.surface.padEnd(7)} ${e.id} (${e.stampability}) verification=actualMission:${e.verification.actualMission},legacyParity:${e.verification.legacyParity} imprintEvidence=${e.imprintEvidence} evidenceSource=${e.stampabilityEvidenceSource} evidenceSourceFilePath=${e.evidenceSourceFilePath ?? 'missing'} modelExposed=${e.modelExposed ?? 'missing'}`);
   const surfaces = summary.bySurface
     .map((s) => `${s.surface}=${s.total}${s.retired > 0 ? `(은퇴 ${s.retired})` : ''}`)
     .join(' · ');
   return [
-    `launch entrances: ${summary.total} (live ${summary.live} · retired ${summary.retired})`,
+    `launch entrances: ${summary.total} (live ${summary.live} · retired ${summary.retired} · closed ${summary.closed})`,
     `  표면별: ${surfaces}`,
     ...rows,
   ].join('\n');

package/src/self-dev/old-door.ts

@@ -0,0 +1,73 @@
+/**
+ * OLD-DOOR-CLOSE — the three outside doors refuse a direct call.
+ *
+ * `elanous dev --ask`, `elanous self implement`, and `elanous self orchestrate`
+ * stay callable from inside the harness. The harness marks those calls with
+ * the same stamp ONEDOOR-1 uses for a door (`ELANOUS_HARNESS_ENTRANCE`) or with
+ * the explicit internal flag `--harness-internal`. A terminal or seat session
+ * carries neither, so it exits non-zero and is told where to go.
+ */
+import type { LaunchDoor } from '../harness/launch-stamp.js';
+
+export const OLD_DOORS = ['dev-ask', 'self-implement', 'self-orchestrate'] as const;
+export type OldDoor = (typeof OLD_DOORS)[number];
+
+/** Same env ONEDOOR-1 already stamps onto a harness launch. */
+export const OLD_DOOR_STAMP_ENV = 'ELANOUS_HARNESS_ENTRANCE';
+/** Same meaning as the env, for a caller that can pass an argument but not an env. */
+export const OLD_DOOR_STAMP_FLAG = '--harness-internal';
+
+const STAMP_BY_DOOR: Readonly<Record<OldDoor, readonly string[]>> = {
+  'dev-ask': ['dev-ask', 'cli-dev-ask', 'cli-drive', 'harness-say', 'cli-harness-say', 'harness-ask', 'cli-harness-ask', 'queue-tick', 'agent-mission', 'daemon-tool'],
+  'self-implement': ['self-implement', 'cli-self-implement', 'nl-self-implement', 'daemon-self-implement', 'daemon-tool', 'harness-say', 'cli-harness-say', 'harness-ask', 'cli-harness-ask', 'queue-tick', 'agent-mission'],
+  'self-orchestrate': ['self-orchestrate', 'cli-self-orchestrate', 'nl-self-orchestrate', 'cli-harness-orchestrate', 'harness-say', 'cli-harness-say', 'harness-ask', 'cli-harness-ask', 'queue-tick', 'agent-mission', 'daemon-tool'],
+};
+
+export interface OldDoorRefusal {
+  readonly door: OldDoor;
+  readonly caller: 'outside';
+  readonly exitCode: 1;
+  readonly message: string;
+}
+
+export function oldDoorStampAccepted(door: OldDoor, stamp: string | undefined | null): boolean {
+  const value = stamp?.trim();
+  if (!value) return false;
+  return (STAMP_BY_DOOR[door] as readonly string[]).includes(value);
+}
+
+/** A harness-internal call carries the stamp in the environment or on the argv. Anything else is outside. */
+export function isOldDoorInternalCall(
+  door: OldDoor,
+  env: NodeJS.ProcessEnv = process.env,
+  argv: readonly string[] = process.argv,
+): boolean {
+  if (argv.includes(OLD_DOOR_STAMP_FLAG)) return true;
+  return oldDoorStampAccepted(door, env[OLD_DOOR_STAMP_ENV]);
+}
+
+/** Env a harness parent sets so the child door stays open. */
+export function oldDoorInternalEnv(door: LaunchDoor | OldDoor): Record<string, string> {
+  return { [OLD_DOOR_STAMP_ENV]: door };
+}
+
+const REPLACEMENT: Readonly<Record<OldDoor, string>> = {
+  'dev-ask': 'elanous harness ask <goal.md>',
+  'self-implement': 'elanous harness say "<sentence>"',
+  'self-orchestrate': 'elanous harness say "<sentence>"',
+};
+
+const DOOR_LABEL: Readonly<Record<OldDoor, string>> = {
+  'dev-ask': 'elanous dev --ask',
+  'self-implement': 'elanous self implement',
+  'self-orchestrate': 'elanous self orchestrate',
+};
+
+/** One line: the closed door, the harness door to use, and a command of the same meaning. */
+export function oldDoorRefusalMessage(door: OldDoor): string {
+  return `${DOOR_LABEL[door]} 는 닫혔습니다 — harness say / harness ask 로. 예: ${REPLACEMENT[door]}`;
+}
+
+export function refuseOldDoor(door: OldDoor): OldDoorRefusal {
+  return { door, caller: 'outside', exitCode: 1, message: oldDoorRefusalMessage(door) };
+}

package/src/self-dev/run-store.ts

@@ -28,6 +28,7 @@ import type { RunIdSource } from '../harness/harness-space.js';
 import { withFileLockSync } from '../storage/file-lock.js';
 import type { SelfDevJobResult, SelfDevGoal } from './orchestrate.js';
 import type { SupervisorStopReason } from './run-supervisor.js';
+import type { SupervisorNext } from './supervisor-verdict-edges.js';
 import { loadMirroredRunRecord, mirrorRunRecord } from './run-record-mirror.js';
 
 export interface SelfDevRunParticipant {
@@ -92,6 +93,8 @@ export interface SelfDevRunState {
   parkedResolution?: SelfDevRunResolution;
   /** The closed supervisor termination reason, persisted independently from per-goal results. */
   supervisorStopReason?: SupervisorStopReason;
+  /** Named next step at supervisor termination; legacy checkpoints omit it. */
+  next?: SupervisorNext;
   /** ★ C(2026-07-21·HITL 정황 품질) — 이 run 을 구동하는 오케스트레이터 프로세스 pid. 살아있으면
    *  non-terminal goal 은 **실행중(running)** 이지 막힌(interrupted) 게 아니다. 죽었으면(오케스트레이터
    *  killed) 진짜 interrupted. isPidAlive 로 구분해 라이브 잡을 parked/repair-signals 에서 제외. */
@@ -311,13 +314,14 @@ export function recordSelfDevRunSupervisorStop(
   runId: string,
   supervisorStopReason: SupervisorStopReason,
   dir = selfDevRunsDir(),
+  next?: SupervisorNext,
 ): SupervisorStopPersistenceOutcome {
   try {
     if (!existsSync(dir)) return { outcome: 'missing-directory' };
     return withFileLockSync(join(dir, `${runId}.lock`), () => {
       const state = loadSelfDevRunFromPath(runPath(runId, dir));
       if (!state) return { outcome: 'missing-record' };
-      writeSelfDevRun({ ...state, updatedAt: Date.now(), supervisorStopReason }, dir);
+      writeSelfDevRun({ ...state, updatedAt: Date.now(), supervisorStopReason, ...(next === undefined ? {} : { next }) }, dir);
       return { outcome: 'persisted' };
     });
   } catch {

package/src/self-dev/run-supervisor.ts

@@ -6,6 +6,7 @@ import type { SelfDevJobResult } from './orchestrate.js';
 import { recordSelfDevRunSupervisorStop, selfDevRunsDir } from './run-store.js';
 import { debug } from '../debug/log.js';
 import { sweepFrozenMerges } from '../self-implement/frozen-merges.js';
+import { routeSupervisorVerdict, type SupervisorNext } from './supervisor-verdict-edges.js';
 
 export interface SupervisorRound {
   round: number;
@@ -186,6 +187,7 @@ function formatGoalPlanRevisionObservation(results: readonly SelfDevJobResult[])
 export type SupervisorJobResult = SelfDevJobResult & {
   reviewReason?: string;
   salvage?: 'launched' | 'parked';
+  next?: SupervisorNext;
 };
 
 export function decideNextRun(input: {
@@ -592,9 +594,13 @@ export async function superviseRun(opts: SuperviseRunOptions): Promise<Superviso
     } catch { /* fail-open */ }
 
     if (decision.action === 'stop') {
+      const reason = decision.stopReason ?? 'unregistered-stop';
+      const next = routeSupervisorVerdict(reason, results).next;
+      try { debug.log('self-dev.supervisor', 'verdict-edge', { runId, reason, next }); } catch { /* observation must not interrupt supervision */ }
+      results = results.map((result) => ({ ...result, next }));
       if (runId && decision.stopReason) {
         const storage = resolveSupervisorStopStorage(opts.runStore);
-        const persistence = recordSelfDevRunSupervisorStop(runId, decision.stopReason, storage.path);
+        const persistence = recordSelfDevRunSupervisorStop(runId, decision.stopReason, storage.path, next);
         const storageObservation = {
           storagePath: storage.path,
           storageSource: storage.source,

package/src/self-dev/supervisor-verdict-edges.ts

@@ -0,0 +1,46 @@
+import type { SelfDevJobResult } from './orchestrate.js';
+import type { SupervisorStopReason } from './run-supervisor.js';
+
+export type SupervisorNext = 'harvest' | 'scope-decompose' | 'self-review' | 'human-gate' | 'proposal';
+export type SupervisorVerdictEdge = { readonly meaning: string; readonly next: SupervisorNext };
+
+// 목표 규칙: 사람 관문은 결제·공개·자격·비가역 결정에만. 지금 max-rounds·provider-exhausted·step-timeout 이 human-gate 인 것은
+// 그 규칙의 예외로 «그대로» 둔 값이다(시험에 고정 — 바꾸면 보인다).
+export const SUPERVISOR_VERDICT_EDGES = {
+  converged: { meaning: 'run converged', next: 'harvest' },
+  'human-stopped': { meaning: 'human stopped the run', next: 'human-gate' },
+  'parent-signals-red': { meaning: 'parent decision signals are red', next: 'human-gate' },
+  'needs-human': { meaning: 'unresolved human or harvest decision', next: 'human-gate' },
+  'no-actionable-work': { meaning: 'no actionable work remains', next: 'self-review' },
+  'harvestable-awaiting-human': { meaning: 'implementation awaits harvest', next: 'harvest' },
+  'handed-off-to-salvage': { meaning: 'salvage already owns the work', next: 'harvest' },
+  'max-rounds': { meaning: 'round budget exhausted', next: 'human-gate' },
+  'no-progress': { meaning: 'run stalled', next: 'scope-decompose' },
+  'provider-exhausted': { meaning: 'provider quota exhausted', next: 'human-gate' },
+  'step-timeout': { meaning: 'step budget exhausted', next: 'human-gate' },
+  'decomposable-no-progress': { meaning: 'stalled with a decomposition proposal', next: 'scope-decompose' },
+  'review-unobserved': { meaning: 'review was not observed', next: 'self-review' },
+  'deliverable-unobserved': { meaning: 'deliverable was not observed', next: 'self-review' },
+  'deliverable-merged': { meaning: 'deliverable is merged', next: 'harvest' },
+} as const satisfies Record<SupervisorStopReason, SupervisorVerdictEdge>;
+
+const HUMAN_GATE_MERGE_REASONS: ReadonlySet<string> = new Set(['decision-signal-red', 'signal-incomplete', 'parent-unlanded', 'human-gate']);
+
+/** Unknown stop vocabularies are proposals, never silently treated as approved edges. */
+export function routeSupervisorVerdict(
+  reason: string,
+  results: readonly Partial<Pick<SelfDevJobResult, 'status' | 'stage' | 'merged' | 'prNumber' | 'prUrl' | 'blockReason' | 'mergeReason'>>[] = [],
+): SupervisorVerdictEdge {
+  const edge = Object.hasOwn(SUPERVISOR_VERDICT_EDGES, reason)
+    ? SUPERVISOR_VERDICT_EDGES[reason as SupervisorStopReason]
+    : undefined;
+  if (!edge) return { meaning: 'unregistered supervisor stop reason', next: 'proposal' };
+  if (reason !== 'needs-human') return edge;
+  if (results.some((result) => result.blockReason === 'parent-unlanded')) return edge;
+  // A human-gate reason on ANY result in the run keeps the whole run at the human gate.
+  if (results.some((result) => HUMAN_GATE_MERGE_REASONS.has(String(result.mergeReason)))) return edge;
+  const openPrs = results.filter((result) => result.status === 'done' && result.stage === 'pr-opened'
+    && result.merged !== true && (result.prNumber !== undefined || Boolean(result.prUrl)));
+  if (openPrs.length === 0) return edge;
+  return { meaning: 'open PR ready for harvest', next: 'harvest' };
+}